The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111817: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed…5.3 Medium6.9 Medium0%Oct 21, 2026
CVE-2026-111815: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…10.0 Critical7.8 High0%Oct 21, 2026
CVE-2026-111814: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one…10.0 Critical7.8 High0%Oct 21, 2026
CVE-2026-111812: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…10.0 Critical7.0 High0%Oct 21, 2026
CVE-2026-111811: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the…9.0 Critical9.4 Critical0%Oct 21, 2026
CVE-2026-111810: Apache Software Foundation Apache Traffic Server: Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header…7.5 High8.7 High0%Oct 21, 2026
CVE-2026-111809: Apache Software Foundation Apache Traffic Server: Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding9.3 Critical6.9 Medium0%Oct 21, 2026
CVE-2026-111808: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame8.6 High7.7 High0%Oct 21, 2026
CVE-2026-111805: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length…8.6 High7.7 High0%Oct 21, 2026
CVE-2026-79976: zephyrproject zephyr: The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file,…7.1 HighN/A0%Oct 21, 2026
CVE-2026-78119: zephyrproject zephyr: The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse()…6.3 MediumN/A0%Oct 21, 2026
CVE-2026-78118: zephyrproject zephyr: The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it…7.0 HighN/A0%Oct 21, 2026
CVE-2026-78117: zephyrproject zephyr: The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet…4.2 MediumN/A0%Oct 21, 2026
CVE-2026-78116: zephyrproject zephyr: The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails5.2 MediumN/A0%Oct 21, 2026
CVE-2026-19947: zephyrproject zephyr: The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-19676: zephyrproject zephyr: The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c,…7.8 HighN/A0%Oct 21, 2026
CVE-2026-18748: zephyrproject zephyr: The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len…3.5 LowN/A0%Oct 21, 2026
CVE-2026-114361: n/a HarnessRouter: A vulnerability was detected in HarnessRouter up to 0.31.105.6 Medium6.3 Medium0%Oct 21, 2026
CVE-2026-114268: Tenda BE3L Pro: A flaw has been found in Tenda BE3L Pro 16.03.60.629.9 Critical8.6 High1%Oct 21, 2026
CVE-2026-114267: SourceCodester Food Order Management System: A vulnerability was detected in SourceCodester Food Order Management System 1.07.3 High5.5 Medium0%Oct 21, 2026
CVE-2026-114266: ProjectWorlds Advanced Library Management System: A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-113870: MongoDB Compass: MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into…8.8 High8.6 High0%Oct 21, 2026
CVE-2026-113461: Checkmk GmbH Checkmk: Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library…N/A5.2 Medium0%Oct 21, 2026
CVE-2026-111816: Apache Software Foundation Apache Traffic Server: Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the…9.3 Critical9.2 Critical0%Oct 21, 2026
CVE-2026-111813: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments…10.0 Critical10.0 Critical0%Oct 21, 2026
1051-1075 of 413321
‹›